For IndividualsFor Educators
ExpertMinds LogoExpertMinds
ExpertMinds

Ace your certifications with Practice Exams and AI assistance.

  • Browse Exams
  • For Educators
  • Blog
  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Support
  • AWS SAA Exam Prep
  • PMI PMP Exam Prep
  • CPA Exam Prep
  • GCP PCA Exam Prep

© 2026 TinyHive Labs. Company number 16262776.

    PracticeGCP Professional Cloud ArchitectGCP Professional Cloud Architect Practice Exam 3Question 14
    Easy1 markMultiple Choice
    Domain 2: Managing and Provisioning a Solution InfrastructureDomain 2Cloud LoggingBigQueryAudit Logging
    This question is part of a case study — click to read the full scenario(Case 11)

    CASE STUDY: CareData Health

    Company Overview:
    CareData Health is a large healthcare provider network operating 50 hospitals. They manage petabytes of patient records, medical imaging, and telemetry data.

    Current Technical Environment:

    • Decentralized on-premises data centers at each hospital
    • Legacy Electronic Health Record (EHR) systems
    • Fragmented data silos preventing holistic patient views

    Business Requirements:

    • Centralize patient data into a single secure data lake
    • Enable machine learning for predictive diagnostics
    • Securely share anonymized data with external research partners

    Executive Statements:

    • CEO: "We must leverage AI to improve patient outcomes and reduce readmission rates."
    • CISO: "Zero tolerance for data breaches. Patient data must be encrypted everywhere, and we must prevent any unauthorized data exfiltration."
    • DPO (Data Protection Officer): "We must strictly adhere to HIPAA in the US and GDPR for our European patients. Data residency is mandatory."

    Technical Requirements:

    • End-to-end encryption using keys managed by CareData
    • Strict access controls and comprehensive audit logging
    • Ingestion of HL7 and FHIR healthcare data formats
    • Physical separation of EU and US data

    Constraints:

    • Highly regulated environment
    • Legacy systems cannot be modified, only integrated with

    QUESTION:
    To meet the CISO's requirement of preventing unauthorized data exfiltration from the centralized data lake (BigQuery and Cloud Storage), which security control should you implement?

    View full case study page →

    GCP PCA · Question 14 · Domain 2: Managing and Provisioning a Solution Infrastructure

    CASE STUDY: CareData Health

    Company Overview:
    CareData Health is a large healthcare provider network operating 50 hospitals. They manage petabytes of patient records, medical imaging, and telemetry data.

    Current Technical Environment:

    • Decentralized on-premises data centers at each hospital
    • Legacy Electronic Health Record (EHR) systems
    • Fragmented data silos preventing holistic patient views

    Business Requirements:

    • Centralize patient data into a single secure data lake
    • Enable machine learning for predictive diagnostics
    • Securely share anonymized data with external research partners

    Executive Statements:

    • CEO: "We must leverage AI to improve patient outcomes and reduce readmission rates."
    • CISO: "Zero tolerance for data breaches. Patient data must be encrypted everywhere, and we must prevent any unauthorized data exfiltration."
    • DPO (Data Protection Officer): "We must strictly adhere to HIPAA in the US and GDPR for our European patients. Data residency is mandatory."

    Technical Requirements:

    • End-to-end encryption using keys managed by CareData
    • Strict access controls and comprehensive audit logging
    • Ingestion of HL7 and FHIR healthcare data formats
    • Physical separation of EU and US data

    Constraints:

    • Highly regulated environment
    • Legacy systems cannot be modified, only integrated with

    QUESTION:
    To meet the requirement for comprehensive audit logging, the security team needs to retain all data access logs for 7 years and query them rapidly during compliance audits. How should you configure this?

    Answer options:

    A.

    Enable Data Access audit logs and retain them in Cloud Logging for 7 years.

    B.

    Enable Data Access audit logs in Cloud Logging and create a log sink to route them to BigQuery.

    C.

    Export the logs to a Cloud Storage Archive bucket.

    D.

    Install the Ops Agent on all VMs to send syslog data to Security Command Center.

    How to approach this question

    Identify the two requirements: long-term retention (7 years) and rapid querying. BigQuery is the standard GCP solution for log analytics and long-term searchable retention.

    Full Answer

    B.Enable Data Access audit logs in Cloud Logging and create a log sink to route them to BigQuery.✓ Correct
    By default, GCP records Admin Activity logs, but Data Access logs (who read/wrote specific data) must be explicitly enabled. To retain these logs for 7 years and query them rapidly, the architectural best practice is to create a Cloud Logging sink that exports the logs to BigQuery.

    Common mistakes

    Choosing Cloud Storage Archive (C) is a common mistake. While it is the cheapest option for long-term retention, it fails the 'rapidly query' requirement.
    Question 13All questionsQuestion 15

    Practice the full GCP Professional Cloud Architect Practice Exam 3

    50 questions · hints · full answers · grading

    Sign up freeTake the exam

    More questions from this exam

    Q01**CASE STUDY: TechStream Gaming** **Company Overview:** TechStream Gaming is a global gaming com...MediumQ02**CASE STUDY: TechStream Gaming** **Company Overview:** TechStream Gaming is a global gaming com...HardQ03**CASE STUDY: TechStream Gaming** **Company Overview:** TechStream Gaming is a global gaming com...MediumQ04**CASE STUDY: TechStream Gaming** **Company Overview:** TechStream Gaming is a global gaming com...EasyQ05**CASE STUDY: TechStream Gaming** **Company Overview:** TechStream Gaming is a global gaming com...Medium
    View all 50 questions →